Two Clocks, One Window: Interval Logic Inside an Aerospace Plant
An aerospace facility runs two incompatible interval systems. Airframe, engine and tooling items are due on flight hours, cycles or calendar, whichever comes first. The plant that makes them — autoclaves, chem-process tanks, nitrogen receivers, hydraulic test stands — is due on corrosion-rate arithmetic under API 510 and 570. A turnaround readiness engine has to derive both and land them in the same window.
Aerospace turnarounds are short, rare and unforgiving. When the autoclave is down, every composite part in the building stops, so the window is measured in days and the scope has to be frozen weeks earlier than a refinery would freeze it. That freeze is only trustworthy if the dates behind it were derived, not typed. API 510 sets an internal or on-stream interval at the lesser of half the remaining life computed from measured corrosion rate, or ten years, with the external cycle running separately at five years. On a stainless autoclave shell in clean service the corrosion rate approaches zero and the ten-year cap binds — which means the arithmetic stops being the driver and the door-closure interlock, safety-relief certification and jurisdictional external become the real constraints. The engine has to say which rule produced the date, because in this plant the binding rule changes from asset to asset.
Source: Derived from API 510 (Pressure Vessel Inspection Code), API 570 (Piping Inspection Code), API 579-1/ASME FFS-1 (Fitness-For-Service), ASME Boiler and Pressure Vessel Code Sections V and VIII Division 1, the National Board Inspection Code NB-23, 14 CFR Part 43 and Part 145, 14 CFR 25.571 damage tolerance together with the Airworthiness Limitations Section and Certification Maintenance Requirements, 14 CFR Part 39 airworthiness directives, NAS 410 and EN 4179 for NDT personnel qualification, and Nadcap AC7108 for chemical processing.
| Asset class | Governing basis | What actually drives the interval | Where a typed-in date goes wrong |
|---|---|---|---|
| Composite cure autoclave, shell and door | ASME Section VIII Div 1 as built; API 510 in service; NBIC NB-23 for repair | Lesser of half remaining life or ten years, with the external examination on its own cycle | Corrosion rate is near zero so the code cap binds; planners set five years from habit and lose sight of the door interlock and relief device dates that were the real driver |
| Anodise, etch, alkaline clean and rinse tanks | API 570 for connected piping; lining integrity; Nadcap AC7108 process control | Lining and liner condition assessment, not measured metal loss | UT through a lined wall reads full nominal, returns a near-zero rate and schedules the tank most likely to leak for the furthest-out date |
| Nitrogen, shop air and hydraulic test receivers | ASME Section VIII Div 1; state jurisdictional rules; NBIC NB-23 | Statutory external and internal cycles set by the jurisdiction, not by the owner-user | Owner-user and jurisdictional dates are separate obligations; storing one field silently discards the one that carries a legal penalty |
| Process piping to autoclave, quench and vacuum systems | API 570 by piping service class | Service class assignment plus measured corrosion rate on the governing CML | Class assigned once at commissioning and never revisited after a media, temperature or duty change |
| Airframe structure, engines and rotables | 14 CFR Parts 43 and 145; MSG-3 and MRB programme; ALS and CMR tasks; 14 CFR 25.571; ADs under Part 39 | Flight hours, flight cycles or calendar — whichever expires first | Only one of the three clocks is stored, so an item reads legal on hours while it is already expired on calendar |
| Bond tooling, layup mandrels and holding fixtures | Internal engineering standard plus customer flow-down requirements | Autoclave cycles accumulated, plus dimensional and NDT re-verification | Tool history lives in a separate spreadsheet and never enters the turnaround readiness scope at all |
Why one interval rule cannot cover an aerospace site
Most interval engines are built on a single assumption: an asset accumulates damage at a measurable rate, and the next inspection date is a function of that rate. The assumption holds for a carbon steel vessel in hydrocarbon service. It collapses in an aerospace manufacturing or MRO facility, because the site contains at least three populations of assets whose dates come from three unrelated authorities, and none of them can be forced into the others' logic without producing a number that is wrong in a way nobody notices.
The first population is flight-critical hardware — structure, engines, rotables, life-limited parts. Intervals come from an approved maintenance programme built on MSG-3 logic and published through the Maintenance Review Board Report, with damage-tolerance inspections traceable to 14 CFR 25.571 and mandatory items carried in the Airworthiness Limitations Section and as Certification Maintenance Requirements. Airworthiness directives issued under 14 CFR Part 39 land on top with their own compliance thresholds. None of that is corrosion-rate arithmetic. It is hours, cycles and calendar limits, and the governing one is whichever expires first.
The second population is the plant that makes and repairs the hardware: autoclaves, chemical processing lines, hydraulic test stands, nitrogen and compressed-air receivers, cryogenic storage. This is ordinary pressure equipment under the ASME Boiler and Pressure Vessel Code, subject to jurisdictional inspection and, where the owner-user has adopted them, API 510 and API 570 in service. The third population is tooling — bond tools, layup mandrels, holding fixtures — which usually answers to no external authority and lives on an engineering standard and customer flow-down. A readiness engine that can only hold one of the three is a readiness engine for a third of the site.
The autoclave decides when the turnaround happens
In a composite shop the autoclave is the single point through which every part passes. Its outage is the turnaround. Chem-line drain-down, crane inspection, receiver internals, hydraulic stand recertification and structural access work all get scheduled into the shadow the autoclave casts, because that is the only period in which the building is not consuming parts and the only period in which the disruption is already paid for.
That inverts the normal planning question. In process plant you derive due dates and then argue about when the outage should be. Here the outage is fixed by production commitments, and the engine's job is to tell you which derived dates fall inside the window, which fall before it, and which can legitimately be carried past it. The third category is where the risk sits. Carrying a date past a window is a decision, and it needs its evidence — the corrosion rate, the reading history, the remaining-life figure and the cap that produced it — attached to the deferral rather than living in a spreadsheet on a planner's laptop.
The autoclave also carries drivers that a corrosion-only engine will silently ignore: the door closure and locking-ring interlock proving, the pressure-relief device certification cycle, the vacuum-line and thermocouple system verification that a Nadcap survey will ask to see, and the jurisdictional external examination on its statutory cycle. Every one of those is an interval. They belong in the same engine as shell thickness, or they will simply not appear in the readiness pack, and the first time anyone notices is when the window has already opened.
Lined and coated equipment breaks the thickness arithmetic
Anodise, etch, alkaline clean and rinse tanks are the second constraint on an aerospace turnaround, and they are where naive interval software is most likely to produce a confidently wrong number. These vessels are lined — rubber, PVDF, polypropylene, glass-flake — precisely because the process chemistry would destroy bare steel in months. The lining is the containment boundary in every sense that matters, and the steel behind it is a structural shell that the process is not supposed to reach.
Point an ultrasonic thickness meter at the outside of a lined tank and you will read full nominal wall, year after year. The engine computes a corrosion rate of effectively zero, a remaining life measured in centuries, and a next date at whatever the code cap allows. The tank is meanwhile one holiday in the lining away from rapid, localised, under-film attack that removes wall far faster than any general rate would predict, and the leak path is often a weld seam or a nozzle knuckle where the liner is hardest to apply and hardest to inspect.
The correct behaviour is a per-asset declaration of the governing damage mechanism and an interval driven by lining condition — holiday and spark testing, adhesion checks, visual survey of the liner and the vapour space above the liquid line — with thickness as secondary confirmation rather than primary input. If the engine cannot be told that an asset's interval is condition-driven rather than rate-driven, it will keep generating comfortable dates for the equipment most likely to fail, and the comfort will be indistinguishable from competence right up to the release.
Snapping a derived date to a window that exists
Once dates are derived they have to be reconciled against windows that actually exist, and a great deal of real compliance drift is created in exactly that step. The engine computes 14 August. The next autoclave outage is 3 October. A planner moves the date to 3 October because that is when the work can physically happen. The record now shows a compliant plan, the schedule is clean, and the asset is out of interval for seven weeks.
Snapping forward is nearly always wrong and nearly always what happens, because the alternative — pulling work into an earlier window — costs production hours that somebody has already promised to a customer. A defensible engine snaps backward by default, to the last window preceding the derived date, and treats forward movement as an explicit deferral requiring a justification, a fitness-for-service basis under API 579-1/ASME FFS-1 where the case is thickness-driven, and a named approver. It should also display the excursion in days, because a three-day overrun and a seven-week overrun are not the same conversation and should not appear in the same colour.
The related trap is which date the clock restarts from. If a vessel is inspected two months early to fit an available window, the next interval should generally run from the date it was originally due, not from the date the work was performed. Restarting from the performance date quietly stretches the cycle every time somebody does the responsible thing, and after three turnarounds the asset is on a materially longer interval than the code permits without any individual having decided to put it there.
Crewing the window: NAS 410 is not SNT-TC-1A
Scope, access and crews all have to be settled before the window opens, and in aerospace the crew constraint is the one most often modelled wrongly. Aerospace NDT personnel are certified under NAS 410 in the United States and EN 4179 in Europe. Both are employer-based schemes, but both involve an outside agency or outside Level III in the examination process and require a written practice whose training hours, experience, recertification and vision requirements do not simply mirror ASNT SNT-TC-1A.
A site that also operates process plant will typically certify its plant inspection technicians to SNT-TC-1A. That means two certification schemes, two written practices and two currency clocks running in one building. A resourcing view that treats "UT Level II" as a single attribute will happily assign a technician who is current for the pressure equipment but not eligible on the aerospace side, or the reverse. The error surfaces at the worst possible moment: inside a frozen window, often with a customer representative or an accreditation auditor standing next to the part.
The same logic applies to procedures. Aerospace inspection techniques are approved against customer requirements and the site's written practice, and an eddy current or ultrasonic technique qualified for one alloy, thickness and geometry does not transfer to another. If the engine holds a technique-to-asset mapping alongside a personnel-currency mapping, the readiness pack can be validated weeks before the window instead of being discovered inside it, when the only remaining options are expensive.
What a frozen scope baseline actually has to hold
Freezing scope means taking a snapshot that later work can be measured against. Most systems freeze a work list, which is not enough, because the work list is a conclusion. The inputs that produced it can change underneath it without a single line on the list changing, and the plan then looks stable while its foundations move.
A baseline worth having captures, per task: the derived date and the rule that produced it, the reading set behind it and when it was taken, the corrosion rate together with whether it was short-term, long-term or estimated by analogy, the required minimum thickness and its basis, any deferral decision with its approver and expiry, and the procedure and personnel assumptions. Everything that happens after the freeze then becomes a delta with an owner. When an on-stream reading taken during pre-turnaround work moves a corrosion rate, the engine recomputes and flags the change against the baseline rather than quietly updating the plan and losing the fact that it ever changed.
The measurable outcome is not a nicer report. It is that the readiness meeting three weeks before the window becomes a review of a short list of changes with named owners, instead of a re-litigation of the entire scope from four spreadsheets that have all diverged since the last time anyone compared them.
How to evaluate an interval engine for this environment
Ask the vendor to show you a single asset record in which the derived date is not the one the arithmetic produced — a lined tank running on condition assessment, or a vessel where the code cap beat the half-life calculation. If every demonstration example is a clean corrosion-rate calculation on a carbon steel vessel, the product has only been exercised where the arithmetic is easy, and easy arithmetic is not what an aerospace site is short of.
Ask how a second and third clock are held on the same item, and how "whichever comes first" is presented, including which clock won and the margin to the next. Ask how a jurisdictional external date is kept distinct from an owner-user internal date, because they are different obligations with different consequences. Ask what happens on the day a date moves: who is notified, what the audit record contains, and whether the previous derivation is retained or overwritten. Overwriting should be disqualifying — the history of a date is the evidence for the date.
Finally, ask to see the deferral path end to end, including the linkage into a fitness-for-service assessment and back out to a revised date. Any system can produce a date. A system that can defend a deferred date in front of a jurisdictional inspector, a customer source inspector or a Nadcap auditor is doing something materially harder, and it is the only version of this software worth installing before a turnaround window rather than after one.
Does API 510 apply to a composite cure autoclave?
It applies where the owner-user adopts it and the jurisdiction permits it. The autoclave is a pressure vessel built to ASME Section VIII Division 1, so state jurisdictional inspection is normally mandatory and API 510 becomes the owner-user programme layered on top. The practical consequence is two dates on one asset: a statutory external examination on the jurisdiction's cycle, and an internal or on-stream interval derived from corrosion rate and capped by code.
How should the engine handle flight hours, cycles and calendar together?
It must hold all three as live counters against three independent limits and derive the due date as the earliest expiry, not as a single stored date. Crucially it should record which counter won and the margin to the next one. An item due in 40 calendar days and 2,000 flight hours behaves completely differently from one due in 40 days and 40 hours, and a single date field cannot tell you which you are looking at.
Why does ultrasonic thickness give a false corrosion rate on a lined process tank?
Because the lining is doing the work the steel is not. UT from outside reads the steel wall, which is protected and therefore stable, so the computed rate approaches zero and remaining life approaches infinity. The real mechanism is under-lining attack after a holiday or disbondment, which is localised and fast. Absence of measured general thinning is not evidence of integrity when the governing damage mechanism was never general thinning.
What happens when a derived due date falls between two turnaround windows?
The default has to be to snap backward, into the last window that precedes the derived date. Snapping forward to the next convenient outage produces a plan that reads as compliant while the asset sits out of interval for the gap. Forward movement should be a recorded deferral with a named approver, a stated basis — a fitness-for-service assessment where the case is thickness-driven — and the excursion shown in days.
Is NAS 410 certification interchangeable with SNT-TC-1A for scheduling technicians?
No. Aerospace NDT personnel are qualified under NAS 410 in the United States or EN 4179 in Europe, with an outside agency or outside Level III involved in examination and a written practice whose training hours, recertification and vision requirements are not identical to ASNT SNT-TC-1A. A site running both process plant and aerospace work carries two schemes and two currency clocks, and a resourcing view that stores one attribute will mis-assign people.
What should be frozen when a turnaround scope baseline is locked?
Not just the work list. Freeze the derived date and the rule that produced it, the reading set behind it with its date, the corrosion rate and whether it was short-term, long-term or estimated, the required minimum thickness and its basis, any deferral and its approver, and the procedure and personnel assumptions for each task. Everything after the freeze then becomes a delta with an owner rather than an undetectable drift.
Built for any business that runs on operations
Most companies do not fail at their craft. They lose time, margin and goodwill in the gaps between the tools they use to run the place — a quoting spreadsheet that does not talk to the job sheet, a job sheet that does not reach accounts, and a compliance folder nobody can search when a client asks. Atlantis closes those gaps by putting the whole operation on one platform, so information is entered once and everything downstream stays in step.
What you can run on it
- Sales and CRM — leads, quotes, follow-ups and the pipeline that tells you what next month looks like.
- Projects and job costing — plan the work, track the hours and materials against it, and see the margin while the job is still live rather than at final account.
- Field and service teams — dispatch, schedules, mobile capture that works with no signal, and sign-off from site.
- Inventory and purchasing — stock, suppliers, reorder points and goods receipt, joined to the jobs that consume them.
- People — records, qualifications and licences with renewal reminders, timesheets, leave and payroll.
- Quality and documents — procedures and forms under revision control, with the audit trail an inspection or accreditation body actually asks for.
- Accounts — invoicing, expenses, multi-currency and the reporting your accountant stops chasing you for.
Affordable, accessible, fully customizable — and we mean each word
Affordable because the whole suite is included rather than sold to you a module at a time, and because implementation is done by people who have run operations rather than by a chain of subcontractors. Accessible because it runs in a browser and on a phone, works for a small team on day one, and does not need a specialist on staff to keep it alive. Fully customizable because your process is the thing that makes you competitive — the software should bend to it, not the other way round.
Industries we configure for
Service businesses and contractors, manufacturing and fabrication, trading and distribution, laboratories and testing houses, engineering consultancies, construction and facilities, and asset owners across energy, marine, aerospace and infrastructure. Inspection and testing is where we started, and it remains the sector we go deepest in — but the platform underneath is general-purpose, and most of what it does has nothing to do with inspection at all.
What happens when you get in touch
A short conversation, not a sales sequence. We ask how the business runs today and where it hurts, show you the platform doing that work, and send a written quote shaped to your region, your team size and the scope you actually need. No obligation, nothing to install first, and no pressure to decide on the call. Reach out and tell us what you are trying to fix.
Related: business management platform · inspection management software · choosing the right category of software · modules · by industry · asset integrity platform. Book a free consultation.